融合文本与链接分析,提升钓鱼邮件识别准确率
Dual-Path Phishing Detection: Integrating Transformer-Based NLP with Structural URL Analysis
- 分两条路径:用DistilBERT分析邮件内容,用字符级TF-IDF+随机森林分析网址结构
- 在真实数据集上,该方法检测准确率显著优于传统单一分析方式
- 模块化设计便于实际部署,适合安全团队快速集成到现有系统
钓鱼邮件持续威胁电子邮件安全,其欺骗手段同时利用语义和结构漏洞。传统检测方法通常只分析邮件内容或嵌入链接,难以应对复杂攻击。本文提出一种双路径钓鱼检测框架,结合基于Transformer的自然语言处理(如DistilBERT)与经典机器学习方法,联合分析邮件文本和嵌入链接。通过微调的DistilBERT实现高效的文本语义分析,同时采用字符级TF-IDF向量化与随机森林等经典分类器进行链接结构分析。在代表性邮件与链接数据集上的实证评估显示,该方法显著提升检测性能:DistilBERT在准确率与计算效率间取得近最优平衡,随机森林在恶意链接识别中明显优于其他经典分类器。模块化设计支持独立部署或集成使用,具备良好的可扩展性与可解释性。结果表明,该双路径方案在应对现代钓鱼威胁方面具有高效、实用且可落地的优势。
原文摘要 · Abstract (English)
Phishing emails pose a persistent and increasingly sophisticated threat, undermining email security through deceptive tactics designed to exploit both semantic and structural vulnerabilities. Traditional detection methods, often based on isolated analysis of email content or embedded URLs, fail to comprehensively address these evolving attacks. In this paper, we propose a dual-path phishing detection framework that integrates transformer-based natural language processing (NLP) with classical machine learning to jointly analyze email text and embedded URLs. Our approach leverages the complementary strengths of semantic analysis using fine-tuned transformer architectures (e.g., DistilBERT) and structural link analysis via character-level TF-IDF vectorization paired with classical classifiers (e.g., Random Forest). Empirical evaluation on representative email and URL datasets demonstrates that this combined approach significantly improves detection accuracy. Specifically, the DistilBERT model achieves a near-optimal balance between accuracy and computational efficiency for textual phishing detection, while Random Forest notably outperforms other classical classifiers in identifying malicious URLs. The modular design allows flexibility for standalone deployment or ensemble integration, facilitating real-world adoption. Collectively, our results highlight the efficacy and practical value of this dual-path approach, establishing a scalable, accurate, and interpretable solution capable of enhancing email security against contemporary phishing threats.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。